@integrity-labs/agt-cli 0.28.1041 → 0.28.1043

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-7ORA3ZVJ.js";
+} from "../chunk-NUGMHIGZ.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-OHT4PWAK.js";
+} from "../chunk-PBMQ4KP6.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-TXRZFABA.js";
+} from "../chunk-O44RDEIA.js";
 import "../chunk-TQDIIS3X.js";
 import "../chunk-XWVM4KPK.js";
 import "../chunk-EL5MWGGH.js";
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1041" : "dev";
+var cliVersion = true ? "0.28.1043" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1041" : "dev";
+var cliVersion2 = true ? "0.28.1043" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-7ORA3ZVJ.js → chunk-NUGMHIGZ.js}

@@ -1,5 +1,6 @@
 import {
   LATE_BOUND_VARS,
+  PLATFORM_DENY_PERMISSIONS,
   agentTmpDirFor,
   buildApiKeyRemoteMcpProxyEntry,
   buildLiveHeaderRemoteMcpProxyEntry,
@@ -15,7 +16,7 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-OHT4PWAK.js";
+} from "./chunk-PBMQ4KP6.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -77,7 +78,7 @@ import {
   sessionTranscriptDir,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-TXRZFABA.js";
+} from "./chunk-O44RDEIA.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -4774,31 +4775,6 @@ function modifyJsonConfig(filePath, fn) {
     return;
   writeFileSync4(filePath, newContent);
 }
-var SECRETS_DENY_PERMISSIONS = [
-  // Read blocks
-  "Read(**/.env*)",
-  "Read(**/.dev.vars*)",
-  "Read(**/*.pem)",
-  "Read(**/*.key)",
-  "Read(**/secrets/**)",
-  "Read(**/credentials/**)",
-  "Read(**/credentials.json)",
-  "Read(**/.aws/**)",
-  // gcloud stores ADC + cached access/refresh tokens under ~/.config/gcloud/
-  // (application_default_credentials.json, credentials.db, access_tokens.db).
-  // Brokered GCP access flows via CLOUDSDK_AUTH_ACCESS_TOKEN env, never these
-  // files, so denying reads here is the GCP analogue of the .aws/ block.
-  "Read(**/.config/gcloud/**)",
-  "Read(**/.ssh/**)",
-  "Read(**/config/database.yml)",
-  "Read(**/config/credentials.json)",
-  "Read(**/.npmrc)",
-  "Read(**/.pypirc)",
-  // Write blocks
-  "Write(**/.env*)",
-  "Write(**/secrets/**)",
-  "Write(**/.ssh/**)"
-];
 var SUBAGENT_BUILTIN_TOOLS = [
   "Bash",
   "Read",
@@ -4898,7 +4874,7 @@ function buildSettingsJson(input) {
       // Temp files
     ])
   ];
-  settings["permissions"] = { deny: SECRETS_DENY_PERMISSIONS };
+  settings["permissions"] = { deny: [...PLATFORM_DENY_PERMISSIONS] };
   return settings;
 }
 var SUBAGENT_CREDENTIAL_CONVENTION = "You inherit the parent agent's environment, including credentials for the integrations below. Most follow the convention `<DEFINITION_ID>_ACCESS_TOKEN` for OAuth and `<DEFINITION_ID>_API_KEY` for API-key integrations \u2014 so GitHub's OAuth token, WHEN it is delivered that way, is `GITHUB_ACCESS_TOKEN`, and Postiz's key is `POSTIZ_API_KEY`. **Some integrations deliberately have no env var at all.** Their credential is never written to this host: the integration's own MCP server fetches a fresh one on every call. For those, the MCP tools ARE the credential \u2014 a missing env var means \"use the tools\", NOT \"not connected\". Never report an integration as unavailable because you could not find a token for it, and never try to reconstruct one. Where a CLI is listed, prefer it over raw curl \u2014 the CLI handles auth automatically.";
@@ -7143,7 +7119,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1041" : "dev";
+var agtCliVersion = true ? "0.28.1043" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -12100,4 +12076,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-7ORA3ZVJ.js.map
+//# sourceMappingURL=chunk-NUGMHIGZ.js.map